package auth

import (
	"strings"
	"testing"
	"time"

	"gitea.tbdevent.eu/TBD/reforger_crawler_main/initializers"
)

func TestSecretEqual(t *testing.T) {
	if SecretEqual("", "") {
		t.Fatal("empty configured secret must never match")
	}
	if SecretEqual("anything", "") {
		t.Fatal("empty configured secret must never match")
	}
	if !SecretEqual("abc", "abc") {
		t.Fatal("equal secrets must match")
	}
	if SecretEqual("abd", "abc") || SecretEqual("ab", "abc") {
		t.Fatal("different secrets must not match")
	}
}

func TestSessionToken(t *testing.T) {
	initializers.AdminSecret = "first-secret-value"
	initializers.AdminSessionTTL = time.Hour
	now := time.Now()

	tok, exp := IssueToken(now)
	got, ok := VerifyToken(tok, now)
	if !ok || got.Unix() != exp.Unix() {
		t.Fatalf("fresh token should verify, ok=%v", ok)
	}

	if _, ok := VerifyToken(tok, now.Add(2*time.Hour)); ok {
		t.Fatal("expired token must not verify")
	}

	parts := strings.Split(tok, ".")
	parts[1] = "9999999999"
	if _, ok := VerifyToken(strings.Join(parts, "."), now); ok {
		t.Fatal("tampered token must not verify")
	}

	if _, ok := VerifyToken("garbage", now); ok {
		t.Fatal("garbage must not verify")
	}

	initializers.AdminSecret = "rotated-secret-value"
	if _, ok := VerifyToken(tok, now); ok {
		t.Fatal("rotating the secret must invalidate sessions")
	}

	initializers.AdminSecret = ""
	if _, ok := VerifyToken(tok, now); ok {
		t.Fatal("no secret configured must reject all sessions")
	}
}

func TestLoginLimiter(t *testing.T) {
	l := NewLoginLimiter(3, time.Minute)
	for range 3 {
		if l.Blocked("1.2.3.4") {
			t.Fatal("blocked too early")
		}
		l.Fail("1.2.3.4")
	}
	if !l.Blocked("1.2.3.4") {
		t.Fatal("should be blocked after max failures")
	}
	if l.Blocked("5.6.7.8") {
		t.Fatal("other IPs must not be affected")
	}
	l.Reset("1.2.3.4")
	if l.Blocked("1.2.3.4") {
		t.Fatal("reset should unblock")
	}
}